registry / @wirecat/max-cli / 0.86.0
@wirecat/max-cli@0.86.0
MAX Messenger bots through the official Bot API, and a personal MAX account, from the terminal — built for agents and scripts
AI Security Review
scanned 6d ago · by lpm-firewall-aiThe lifecycle hook is limited to global-install setup, with agent skill installation gated by an explicit environment selection. The flagged API-key path uses the configured provider endpoint, and OCR requires an explicit request; the scanner alerts were not substantiated as an attack.
Static reason
High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source
Trigger
Global installation for postinstall setup; explicit CLI requests for provider analysis or OCR.
Impact
No unauthorized credential redirection, remote code execution, or agent-control mutation was established.
Mechanism
The package uses provider keys with configured API endpoints and only performs OCR when explicitly enabled.
AI rationale
The lifecycle hook is limited to global-install setup, with agent skill installation gated by an explicit environment selection. The flagged API-key path uses the configured provider endpoint, and OCR requires an explicit request; the scanner alerts were not substantiated as an attack.
Decision evidence
public snapshotAI called this Clean at 90.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The postinstall entry runs setup only for global installs; by default it leaves the agent skill uninstalled.
- The agent skill is written only when MAX_INSTALL_AGENT explicitly selects a target.
- Analysis API keys come from the selected provider’s key store, with default endpoints at the official OpenAI or Anthropic APIs; a custom URL must be configured.
- The OCR gateway rejects use unless an explicit OCR request enables it.
Evidence against
- The package defines prepare and postinstall lifecycle scripts.
- A global install can update the Windows user PATH and can install the skill into selected agent folders when MAX_INSTALL_AGENT is set.
- The online doctor check starts a local MCP server subprocess.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkWebSocket
HighEntropyStrings
Source & flagged code
17 flaggedpackage.jsonView file
•scripts.postinstall = node install/postinstall.mjs
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkg•scripts.postinstall = node install/postinstall.mjs
Medium
Ambiguous Install Lifecycle Script
Install-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkgdist/online.jsView file
1import { spawn } from "node:child_process";
L2: import { createInterface } from "node:readline";
High
Findings
4 Critical9 High7 Medium6 Low
CriticalRemote Asset Decode Executedist/bundle/program-H2NDWRAN.js
CriticalTrojan Source Unicodedist/bundle/chunk-WUE7XPBG.js
CriticalTrigger Reachable Dangerous Capabilitydist/bundle/program-H2NDWRAN.js
CriticalPrevious Version Dangerous Deltadist/bundle/chunk-I5J3BPPO.js
HighInstall Time Lifecycle Scriptspackage.json
HighChild Processdist/online.js
HighSame File Env Network Executiondist/bundle/program-H2NDWRAN.js
HighCredential Redirect Persistencedist/bundle/program-H2NDWRAN.js
HighSandbox Evasion Gated Capabilitydist/bundle/program-H2NDWRAN.js
HighTrigger Reachable External Ai Agent Control Surface Mutationdist/bundle/chunk-R52KGIUV.js
Affected versions and remediation
This report applies to @wirecat/max-cli@0.86.0.
See all versions of @wirecat/max-cli for other recorded verdicts.
- Review the evidence and your use of @wirecat/max-cli@0.86.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.